The email often looks exactly like the real thing.
Service
Business email compromise
A spoofed or hijacked email redirected a payment. We trace the money and establish how the mailbox was compromised.
Overview
How business email compromise works.
Business email compromise is one of the most costly forms of fraud for companies. A supplier's ‘new bank details’, a CEO's urgent request, an invoice that looks exactly right — and a payment goes to the wrong account.
GFIR investigates both sides of the incident: the money and the mailbox. We trace the payment to support a recall or freeze, and we analyse email headers and account activity to establish whether your mailbox, your supplier's, or neither was compromised.
That distinction matters for liability, insurance and preventing it from happening again.
Signs you may need this
- A supplier says they never received a payment you made
- Bank details on an invoice changed by email
- An urgent payment request came from a senior manager's account
- Emails were sent from your account that you didn't write
- Your email has forwarding rules you didn't create
Changed bank details are the most common tell.
Everything is packaged for your bank and insurer.
How it works
Our approach, step by step.
- 01
Act on the payment
We help you contact your bank immediately and prepare evidence to support a recall.
- 02
Analyse the emails
Headers, domains and mail flow reveal whether messages were spoofed or sent from a real, compromised account.
- 03
Review account access
We check sign-in history, rules and permissions to find how the attacker got in.
- 04
Report and prevent
A clear report for your bank, insurer and lawyer, with steps to prevent a repeat.
Who it's for
- Companies that paid a fraudulent invoice
- Finance and accounting teams
What's included
- 01Mail-flow and header forensics
- 02Account compromise review
- 03Fund tracing
- 04Bank and insurer evidence pack
Realistic expectations
Speed matters — banks can sometimes recall payments only within days.Before you contact us
What to prepare.
Don't worry if you don't have everything — send what you can and we'll guide you through the rest.
- ✓The fraudulent email(s) as original files, not forwards
- ✓The invoice and the genuine bank details
- ✓Payment confirmation from your bank
- ✓Admin access (or contact) for your email system
- !Never share passwords, private keys or seed phrases — with anyone, including us.
Questions
About business email compromise
What should we do first?+
Call your bank immediately and ask for a recall. Then preserve the emails as original files and contact us.
Was it our fault or the supplier's?+
That's exactly what the email analysis establishes — whether the fraud came through your mailbox, theirs, or a look-alike domain.
Can the money be recovered?+
Sometimes, if the receiving bank acts quickly. Our evidence pack supports the recall but can't guarantee the outcome.
How do we stop it happening again?+
We recommend practical controls: verification of bank-detail changes by phone, MFA, and monitoring for suspicious mailbox rules.
Guides
Read before you act.
First 24 hours after a business email breach: a checklist
Guide · Business email compromise
Verifying payment changes: a simple process for finance teams
Guide · Business email compromise
Related services
Cryptocurrency tracing
We follow stolen or misdirected digital assets across wallets, chains and bridges, and identify where funds reached exchanges or regulated services.
Online fraud investigation
Investment platforms, impersonation and payment fraud — we reconstruct what happened and who was behind each step.
Digital forensics
Forensically sound collection and analysis of phones, computers, email and cloud accounts, preserving evidence so it can be relied upon later.
Confidential case review
Confidential case review
Tell us what happened.
Your message is read by an investigator, not a sales team. We'll reply with an honest assessment of what can be done.
Have a question first? Read our FAQ →
Prefer email? info@gfirglobal.com